Bring a fix for v8 bug 589 and Chromium bug 27967 to 1.3....

src/ic.h

 // Copyright 2006-2009 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 262 matching lines @@
   // These are similar to the generic IC; they optimize the case of
   // operating upon external array types but fall back to the runtime
   // for all other types.
   static void GenerateExternalArray(MacroAssembler* masm,
                                     ExternalArrayType array_type);
 
   // Clear the use of the inlined version.
   static void ClearInlinedVersion(Address address);
 
  private:
+  // Bit mask to be tested against bit field for the cases when
+  // generic stub should go into slow case.
+  // Access check is necessary explicitly since generic stub does not perform
+  // map checks.
+  static const int kSlowCaseBitFieldMask =
+      (1 << Map::kIsAccessCheckNeeded) | (1 << Map::kHasIndexedInterceptor);
+
   static void Generate(MacroAssembler* masm, const ExternalReference& f);
 
   // Update the inline cache.
   void UpdateCaches(LookupResult* lookup,
                     State state,
                     Handle<Object> object,
                     Handle<String> name);
 
   // Stub accessors.
   static Code* initialize_stub() {
@@ skipping 118 matching lines @@
   // The map is the new map that the inlined code should check against.
   static bool PatchInlinedStore(Address address, Object* map);
 
   friend class IC;
 };
 
 
 } }  // namespace v8::internal
 
 #endif  // V8_IC_H_